EUVD-2026-43771
GHSA-wx9m-v548-jq76
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing flaw needing a user to open crafted content, so AV:L and UI:R with PR:N; impact set to H per Microsoft's code-execution claim, though CWE-125 suggests disclosure may dominate.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Technical ContextAI
The Microsoft Graphics Component is a core Windows subsystem responsible for parsing and rendering graphical content (fonts, images, and drawing primitives) consumed across the OS and by many applications. The root cause is CWE-125, an out-of-bounds read, where the parser reads memory beyond the bounds of an allocated buffer - typically because a length or offset field in attacker-supplied graphics data is not validated against the actual buffer size. While an out-of-bounds read most directly causes information disclosure (and Microsoft's own tags list 'Information Disclosure' and 'Buffer Overflow'), Microsoft's description states the flaw allows local code execution, implying the memory-safety error is leverageable beyond a simple read. The affected CPE set spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025 including Server Core installations, confirming the vulnerable code ships in the shared Windows graphics stack rather than an optional component.
RemediationAI
Apply the Microsoft security update for CVE-2026-58609 as the primary fix; a patch is available per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58609, which enumerates the specific patched build for each affected Windows client and server SKU (no single cross-product fix version is provided in the input, so consult the advisory for the exact KB/build matching your OS). Because exploitation requires a user to open crafted content, interim compensating controls include restricting or blocking untrusted files and email attachments that route through the Windows graphics/rendering stack, enforcing least privilege so a successful exploit runs in a low-privilege context, and using attack-surface-reduction rules and application allow-listing to limit which processes render untrusted graphics - with the trade-off that aggressive attachment or content blocking can disrupt legitimate document and image workflows. Prioritize patching internet-facing and multi-user hosts (RDP/session hosts, Server Core roles) where crafted content is most likely to reach a user.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today